UPGRADING TO LOTUS NOTES 6 AND LOTUS DOMINO 6
Communication with organizations that use flat names
To establish authentication between servers at two different organizations when either organization is flat, the client must have a certificate from a certifier that the server trusts and the server must have a certificate from a certifier that the client trusts. One way to do this is to have each organization send a safe copy of its server IDs to the other for flat certification and upon receiving the newly-certified ID turn off the option "Trust other certificates signed by this certifier."

For example, if two organizations, Alpha and Beta, need to communicate, Alpha's server Hub-A obtains a certificate from Beta and turns off the "Trust" option. Hub-A now has a trusted Alpha certificate and an untrusted Beta certificate. Beta's server Mail-B obtains a certificate from Alpha and turns off the "Trust" option. Mail-B now has a trusted Beta certificate and an untrusted Alpha certificate.

Hub-A presents Beta's certificate to Mail-B because Mail-B trusts that certificate. Mail-B present Alpha's certificate to Hub-A because Hub-A trusts that certificate. Authentication proceeds because the servers have certificates from the same certifiers even though they don't share a trusted certificate.

Optionally, "trust" could be turned on for Beta's certificate on Hub-A, and Hub-A would accept any ID containing a Beta certificate. By doing this, other servers at Alpha do not need to get any new certificates. However, servers at Alpha would be vulnerable to access by fraudulent IDs created by Beta.

Unlike cross-certification used between hierarchical organizations, certifying between flat organizations requires that server IDs be certified individually.

To exchange flat certificates between organizations, each organization should follow the steps described in the topics Recertifying flat IDs using Notes mail or Recertifying flat IDs without Notes mail.

Each organization should make sure to turn off the "Trust other certificates" option for the certificate received from the other organization.

Note Hierarchical organizations that want to certify server IDs of flat organizations must create a flat certifier ID with which to do this.

For more information about creating a flat certifier ID, see the topic Creating a flat certifier ID.